A CISO should be able to explain which PCI DSS version the organization is assessing against, which requirements are now effective, who accepts its compliance reporting, and how payment-page security is managed. PCI DSS v4.0.1 did not add or remove requirements, but the 31 March 2025 deadline for applicable future-dated requirements has passed. The answers below are an executive oversight guide—not a substitute for the standard or a formal assessment.
1. What changed in PCI DSS 4.0.1?
PCI DSS v4.0.1 is a limited revision to v4.0. The PCI Security Standards Council (PCI SSC) says it corrects formatting and typographical errors and clarifies the focus and intent of some requirements and guidance; it adds or deletes no requirements. The Council also kept the existing 31 March 2025 effective date for future-dated requirements. See PCI SSC’s v4.0.1 announcement.
Use the applicable current standard and validation documents when planning an assessment. Do not treat the transition’s count of new requirements as a count of requirements introduced by v4.0.1.
2. Are the future-dated PCI DSS requirements in effect now?
Yes. The 31 March 2025 effective date has passed. Applicable future-dated requirements must be considered in assessments. In a March 2025 interview, a PCI SSC Director of Data Security Standards said: “There are 64 new requirements that were released in PCI DSS and 51 of them are future-dated.” Those counts describe the change history across PCI DSS, not additions made by v4.0.1. The interview also provides guidance on e-commerce requirements taking effect after the transition: PCI SSC’s 26 March 2025 podcast.
#1 Best Overall
3. Which assessment and reporting path applies to our payment environment?
Start with how account data moves, which systems handle it, which systems or pages can affect payment security, and what third parties do. Then confirm the assessment and reporting route with the organization that accepts the compliance result. That is typically a payment brand or acquirer, but the responsible entity and its instructions depend on the organization’s compliance program.
- Map payment flows, account-data handling, relevant systems, payment pages, and third-party services.
- Ask the compliance-accepting entity which validation method and reporting format it requires.
- Confirm eligibility for a Self-Assessment Questionnaire (SAQ) with that entity; do not infer it from using a particular payment vendor.
- Agree who supplies evidence for controls operated by service providers and how that evidence reaches the assessment.
PCI SSC publishes standards and guidance; it does not enforce compliance or decide whether a particular implementation is compliant. Its FAQ 1585 directs entities to the organization managing their compliance program for questions about implementing requirements and reporting.
Rank #2
4. Which PCI requirements apply to our payment pages, and who owns them?
Requirements 6.4.3 and 11.6.1 address the authorization and integrity of scripts loaded on payment pages and the detection of unauthorized changes to payment-page content or HTTP headers. These controls are intended to reduce e-skimming risk. PCI SSC’s March 2025 information supplement on payment-page security offers implementation guidance; it does not add, extend, replace, or supersede requirements.
Make responsibility explicit across the teams and providers that can affect the page:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute- Application and e-commerce teams: identify scripts and changes that are authorized, and keep relevant change records.
- Security monitoring: define how unauthorized changes are detected, who receives alerts, and how incidents are escalated.
- Third-party service providers: establish what evidence they provide for controls they operate and how quickly they report relevant changes or alerts.
- Security leadership: ensure the control has an accountable owner, evidence path, and response process.
5. Does using a third-party payment provider take us out of scope?
Not by itself. Outsourcing account-data functions can be relevant to scope and SAQ eligibility, but a vendor relationship alone does not establish that an organization qualifies for a particular questionnaire or has no remaining responsibilities. Determine which systems and pages can affect payment security, what the merchant still operates, and what evidence is needed for provider-operated controls. Ask the compliance-accepting entity to confirm the applicable route.
6. What changed for SAQ A?
In January 2025, PCI SSC revised SAQ A by removing requirements 6.4.3, 11.6.1, and supporting requirement 12.3.1 from that questionnaire and adding an eligibility criterion: the merchant must confirm its site is not susceptible to script attacks that could affect its e-commerce system. The Council says these questionnaire changes do not remove or diminish the underlying PCI DSS requirements. See PCI SSC’s SAQ A update.
SAQ A eligibility is limited to qualifying merchants that fully outsource account-data functions and do not electronically store, process, or transmit account data on their systems or premises. Confirm current eligibility and reporting instructions with the entity receiving the validation result.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. How should reports treat requirements that have been superseded?
PCI SSC FAQ 1593 says requirements marked as superseded should be reported as not applicable in a Report on Compliance (ROC) or SAQ after 31 March 2025. Its example is requirement 6.4.1 becoming superseded when 6.4.2 takes effect. Before preparing a report, check the current validation-document instructions and confirm which requirements apply to the assessment scope: PCI SSC FAQ 1593.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Best Value
8. Who decides which PCI DSS assessment we need, and when should we seek specialist help?
The compliance-accepting organization—not PCI SSC—sets the program’s validation and reporting expectations. Ask the acquirer or payment brand which assessment applies, which reporting documents it accepts, and whether it requires a Qualified Security Assessor (QSA) or Approved Scanning Vendor (ASV) for the organization’s circumstances.
When specialist assessment or external vulnerability-scanning services are needed, verify the provider’s qualifications and current program standing. Do not assume a provider is required—or accepted—without confirming the compliance program’s instructions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
